PCI DSS

The 12 Basic Requirements of PCI DSS Compliance

• Proper use and maintenance of firewalls: Firewalls are the basic standard to avoid unauthorized access by malicious entities attempting to access private networks.
• Appropriate credentials management: One of the most underlooked aspects of data security is the proper management of passwords. The usage of default passwords and simple Social Engineering tactics can be exploited by malicious actors that seek to penetrate security systems. Therefore, PCI DSS has as one their core requirements to ensure proper compliance of password management to ensure that appropriate policies are in place to secure password-protected devices.
• Cardholder data protection: PCI DSS requires two-fold protection for cardholder data, which must be encrypted with symmetric-key algorithms, which can also be further encrypted. Regular maintenance and scanning of primary number accounts are also necessary to ensure that no sensitive data is left unencrypted.
• Encryption of data streams (data in transit): Cardholder data is sometimes required to be sent across systems. Therefore, previous encryption of these data is necessary.
• Usage and maintenance of antivirus: To prevent malicious attacks, PCI DSS requires antivirus software installed and maintained in all systems involved in the data transactions, which must also be regularly patched and updated.
• Up to date software: Firewalls and antivirus software require frequent updates to catch the latest security threats.
• Restricted data access: Data governance policies must be in place to ensure that cardholder data is sought just by the people who use it and no one else. These data governance policies should be well documented and regularly maintained.
• Unique IDs for cardholder data access: Users with permissions to access cardholder data should be uniquely identified. This measure seeks to reduce vulnerability, and quicker response in case data is compromised.
• Restricted physical access to sensitive data: Sensitive data such as credit cardholder data should be stored in physically secure locations, along with proper information logs about any access to it.
• Access logs and auditing: Information regarding any activities where cardholder data or any other sensitive data was involved must be logged appropriately.
• Continuous vulnerabilities testing and monitoring: Periodic analysis of the points of failure should be undertaken to identify and address security concerns.
• Clear & well-documented Policies: Policies of who data is governed should be well defined and documented, the systems used, and users with sensitive data access.

The main benefit of being PCI DSS compliant is that it ensures that data systems are trustworthy when dealing with sensitive information. That is a practice that ensures proper data governance and security standard.

Cloud Data Security with Satori

Satori, The DataSecOps platform, gives companies the ability to enforce security policies from a single location, across all databases, data warehouses and data lakes. Such security policies can be data masking, data localization, row-level security and more.